Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10-01-2024 21:24
General
-
Target
51a806c8ba7d616905976a250392ec08.exe
-
Size
294KB
-
MD5
51a806c8ba7d616905976a250392ec08
-
SHA1
8bcaa6960d49091e21dccb20b22bd30e2e4b5026
-
SHA256
7282d412589d3463fab960894fef6a653f647ccab3d48d4b9e9b4b12f8013975
-
SHA512
6fbad8142bb4ebc016a0de0e6b1858c04e214bf1309d1018e968b08a10b7ed198aa358bd0dba2eada3caefc6f6e13b7c4734b627de7e261564df1f1404a40216
-
SSDEEP
6144:b7Hyvr7uTCdiXMmJItoaieNLWktF8pJSc7RwoOL:vHyHuKic2GoaieNntOjPNwoO
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SewPalpadin
C2
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51a806c8ba7d616905976a250392ec08.exe"C:\Users\Admin\AppData\Local\Temp\51a806c8ba7d616905976a250392ec08.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-1-0x0000000002E10000-0x0000000002F10000-memory.dmpFilesize
1024KB
-
memory/624-2-0x0000000000250000-0x000000000027F000-memory.dmpFilesize
188KB
-
memory/624-4-0x0000000000400000-0x0000000002C81000-memory.dmpFilesize
40.5MB
-
memory/624-7-0x0000000004860000-0x000000000487E000-memory.dmpFilesize
120KB
-
memory/624-6-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/624-8-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/624-5-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/624-3-0x0000000000300000-0x0000000000320000-memory.dmpFilesize
128KB
-
memory/624-11-0x0000000002E10000-0x0000000002F10000-memory.dmpFilesize
1024KB
-
memory/624-12-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB